CISA Warns SafePay Ransomware Hit 600 Critical Infrastructure Organizations

SafePay ransomware hits 600 critical infrastructure organizations

SafePay ransomware has breached more than 600 critical infrastructure organizations across North America, South America, Europe, and Australia since August 2024, according to a joint advisory from CISA, the FBI, the US Secret Service, and international partners published on October 21, 2026. The group operates as a private, affiliate-free operation, which sets it apart from the franchise-style ransomware gangs that dominated headlines for years. It has filled much of the vacuum left by dismantled operations such as BlackCat and LockBit, and agencies now rank it among the most active ransomware threats in the world.

The advisory is blunt about how SafePay gets in. Initial access comes through credential exposure, brute-force attacks, and exploitation of VPN edge devices, including the use of Mullvad VPN IP addresses and phished account profiles. Once inside, the group performs double extortion: stealing sensitive data before encrypting systems, then threatening public release if the ransom goes unpaid. Recovery is made harder by deliberate deletion of shadow copies and wiping of network-attached storage backups.

How SafePay ransomware gets in

The number that should worry defenders most is 63 percent: the share of post-access scenarios in which valid credentials bypassed prevention controls, according to the advisory's analysis. That is not a story about exotic zero-days. It is a story about identity abuse. A stolen password, a phished login, or a VPN account with weak authentication can carry an attacker past expensive perimeter defenses without triggering the alarms those defenses were built to raise.

VPN edge devices are a recurring weak point here. They sit at the boundary of the network, they are often patched late, and they grant broad access once authenticated. SafePay's use of VPN infrastructure, including Mullvad IP addresses, is a reminder that the edge device is not a neutral pipe. It is an attack surface, and it needs the same patching discipline and multi-factor authentication as any other privileged system.

Why critical infrastructure is the target

Critical infrastructure organizations cannot simply shut down and rebuild at leisure. Hospitals, utilities, transport operators, and manufacturers face real pressure to restore service fast, which is exactly what double extortion exploits. Paying does not guarantee data deletion, and not paying risks public exposure, but the operational urgency tilts the calculation in the attacker's favor. That is why agencies publish these advisories: to give defenders the indicators and behaviors they need before an incident, not after.

This is also a different pattern from the breach disclosures that filled October. Advantest disclosed stolen passports, SSNs, and medical records months after its attack, and the Everest group's PwC claim remains unconfirmed. SafePay is not a single claim or a single disclosure. It is a sustained campaign across hundreds of organizations, documented by multiple governments at once. That scale is what makes it a sector-wide warning rather than a single company's bad week.

What defenders should do now

The advisory's practical lessons are unglamorous and effective. Enforce phishing-resistant multi-factor authentication, especially on VPN and remote access. Patch VPN edge devices on a schedule that treats them as critical, not convenient. Segment networks so a single stolen credential does not grant lateral movement across the whole environment. Protect backups from deletion, including offline or immutable copies that ransomware cannot wipe from inside the network.

None of that is new advice, which is the uncomfortable point. SafePay's success comes less from novel techniques than from organizations leaving known gaps open. The joint advisory gives defenders a shared playbook for closing them. The question is whether the next 600 victims will have read it.